ISRG Root X1 added to Firefox for next release

Actually not really. The trust roots, held by a store like Microsoft or Mozilla are really just public keys. It turns out to be more practical to transport and store them as self-signed certificates, but what we're trusting won't be the certificate, only the public key inside it. If for example the certificate expires, software using the trust store generally won't even care. Insisting on a self-signed certificate means we know the owner actually has the private key (they can't just tell us someone else's public key) and they can bake in some metadata like an agreed name (in X.509 Distinguished Name notation) for the entity.

Think of the PKI as a directed (but NB not acyclic) graph, with public key pairs as nodes, and certificates as named edges on the graph. The self-signed certificate in the trust store is a way to talk about a single node in the graph, even though the certificate itself actually represents a looped edge from that node to itself.

1 Like